@archlast/server 0.0.1

package/dist/controllers/invite.controller.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Invite Controller (Elysia Plugin)
+ * Handles /_auth/invites/* endpoints
+ *
+ * Business logic has been extracted to InviteService.
+ * This controller handles HTTP concerns only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inviteController = void 0;
+const elysia_1 = require("elysia");
+const schema_js_1 = require("../auth/system/schema.js");
+const invite_service_js_1 = require("../services/invite.service.js");
+const service_js_1 = require("../email/service.js");
+const context_helper_js_1 = require("../http/context-helper.js");
+// Input schemas
+const CreateInviteSchema = elysia_1.t.Object({
+    email: elysia_1.t.String({ format: "email" }),
+    role: elysia_1.t.Optional(elysia_1.t.String()),
+    permissions: elysia_1.t.Optional(elysia_1.t.Array(elysia_1.t.String())),
+});
+// Create singleton service instance
+const inviteService = (0, invite_service_js_1.createInviteService)();
+exports.inviteController = new elysia_1.Elysia({ prefix: "/invites", tags: ["Invites"] })
+    /**
+     * GET /_auth/invites
+     * List current user's pending invites
+     */
+    .get("/", async (ctx) => {
+    const { db, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    // Get user email to find invites
+    const userData = await db.get(schema_js_1.AUTH_COLLECTIONS.users, user.id);
+    if (!userData) {
+        return { invites: [] };
+    }
+    try {
+        const invites = await inviteService.listUserInvites({
+            userId: user.id,
+            userEmail: userData.email,
+            db,
+        });
+        return { invites };
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    detail: { summary: "List user's invites" },
+})
+    /**
+     * POST /_auth/invites/:id/accept
+     * Accept an invite
+     */
+    .post("/:id/accept", async (ctx) => {
+    const { db, params, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    // Get user email
+    const userData = await db.get(schema_js_1.AUTH_COLLECTIONS.users, user.id);
+    try {
+        await inviteService.acceptInvite({
+            inviteId: params.id,
+            userId: user.id,
+            userEmail: userData?.email,
+            db,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    params: elysia_1.t.Object({ id: elysia_1.t.String() }),
+    detail: { summary: "Accept invite" },
+})
+    /**
+     * POST /_auth/invites/:id/decline
+     * Decline an invite
+     */
+    .post("/:id/decline", async (ctx) => {
+    const { db, params, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    // Get user email
+    const userData = await db.get(schema_js_1.AUTH_COLLECTIONS.users, user.id);
+    try {
+        await inviteService.declineInvite({
+            inviteId: params.id,
+            userId: user.id,
+            userEmail: userData?.email,
+            db,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    params: elysia_1.t.Object({ id: elysia_1.t.String() }),
+    detail: { summary: "Decline invite" },
+})
+    /**
+     * GET /_auth/invites/tenants/:tenantId
+     * List invites for a tenant
+     */
+    .get("/tenants/:tenantId", async (ctx) => {
+    const { db, params, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    try {
+        const invites = await inviteService.listTenantInvites({
+            tenantId: params.tenantId,
+            requesterUserId: user.id,
+            db,
+        });
+        return { invites };
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    params: elysia_1.t.Object({ tenantId: elysia_1.t.String() }),
+    detail: { summary: "List tenant's invites" },
+})
+    /**
+     * POST /_auth/invites/tenants/:tenantId
+     * Create invite for tenant
+     */
+    .post("/tenants/:tenantId", async (ctx) => {
+    const { db, params, body, request, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    const origin = request.headers.get("origin") ||
+        process.env.ARCHLAST_PUBLIC_URL ||
+        "http://localhost:3000";
+    try {
+        const result = await inviteService.createInvite({
+            tenantId: params.tenantId,
+            email: body.email,
+            role: body.role,
+            permissions: body.permissions,
+            requesterUserId: user.id,
+            origin,
+            db,
+            emailService: (0, service_js_1.getEmailService)(),
+        });
+        return result;
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    params: elysia_1.t.Object({ tenantId: elysia_1.t.String() }),
+    body: CreateInviteSchema,
+    detail: { summary: "Create tenant invite" },
+})
+    /**
+     * DELETE /_auth/invites/:id
+     * Revoke an invite
+     */
+    .delete("/:id", async (ctx) => {
+    const { db, params, set, user } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    try {
+        await inviteService.revokeInvite({
+            inviteId: params.id,
+            requesterUserId: user.id,
+            db,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        if (error instanceof invite_service_js_1.InviteError) {
+            set.status = error.statusCode;
+            return { error: error.message };
+        }
+        throw error;
+    }
+}, {
+    params: elysia_1.t.Object({ id: elysia_1.t.String() }),
+    detail: { summary: "Revoke invite" },
+});
+//# sourceMappingURL=invite.controller.js.map

package/dist/controllers/invite.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.controller.js","sourceRoot":"","sources":["../../src/controllers/invite.controller.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,mCAAmC;AACnC,wDAA4D;AAC5D,qEAAiF;AACjF,oDAAsD;AACtD,iEAAmD;AAEnD,gBAAgB;AAChB,MAAM,kBAAkB,GAAG,UAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpC,IAAI,EAAE,UAAC,CAAC,QAAQ,CAAC,UAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,WAAW,EAAE,UAAC,CAAC,QAAQ,CAAC,UAAC,CAAC,KAAK,CAAC,UAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/C,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,aAAa,GAAG,IAAA,uCAAmB,GAAE,CAAC;AAE/B,QAAA,gBAAgB,GAAG,IAAI,eAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACjF;;;OAGG;KACF,GAAG,CACA,GAAG,EACH,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,4BAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,eAAe,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAG,QAAgB,CAAC,KAAK;YAClC,EAAE;SACL,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE;CAC7C,CACJ;IACD;;;OAGG;KACF,IAAI,CACD,aAAa,EACb,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,iBAAiB;IACjB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,4BAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC;QACD,MAAM,aAAa,CAAC,YAAY,CAAC;YAC7B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAG,QAAgB,EAAE,KAAK;YACnC,EAAE;SACL,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,MAAM,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;CACvC,CACJ;IACD;;;OAGG;KACF,IAAI,CACD,cAAc,EACd,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,iBAAiB;IACjB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,4BAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/D,IAAI,CAAC;QACD,MAAM,aAAa,CAAC,aAAa,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAG,QAAgB,EAAE,KAAK;YACnC,EAAE;SACL,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;CACxC,CACJ;IACD;;;OAGG;KACF,GAAG,CACA,oBAAoB,EACpB,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC;YAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,IAAI,CAAC,EAAE;YACxB,EAAE;SACL,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;CAC/C,CACJ;IACD;;;OAGG;KACF,IAAI,CACD,oBAAoB,EACpB,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GACR,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,uBAAuB,CAAC;IAE5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC;YAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,EAAE;YACxB,MAAM;YACN,EAAE;YACF,YAAY,EAAE,IAAA,4BAAe,GAAE;SAClC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1C,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;CAC9C,CACJ;IACD;;;OAGG;KACF,MAAM,CACH,MAAM,EACN,KAAK,EAAE,GAAQ,EAAE,EAAE;IACf,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC;QACD,MAAM,aAAa,CAAC,YAAY,CAAC;YAC7B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,eAAe,EAAE,IAAI,CAAC,EAAE;YACxB,EAAE;SACL,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,+BAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,EACD;IACI,MAAM,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpC,MAAM,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;CACvC,CACJ,CAAC"}

package/dist/controllers/mfa.controller.d.ts

@@ -0,0 +1,211 @@
+/**
+ * MFA Controller (Elysia Plugin)
+ * Handles /_auth/mfa/* endpoints for TOTP management
+ */
+import { Elysia } from "elysia";
+export declare const mfaController: Elysia<"/mfa", {
+    decorator: {};
+    store: {};
+    derive: {};
+    resolve: {};
+}, {
+    typebox: {};
+    error: {};
+}, {
+    schema: {};
+    standaloneSchema: {};
+    macro: {};
+    macroFn: {};
+    parser: {};
+    response: {};
+} & {
+    schema: {};
+    standaloneSchema: {};
+    macro: Partial<{}>;
+    macroFn: ({ onBeforeHandle }: any) => {
+        requireAuth(enabled: boolean): void;
+    };
+    parser: {};
+    response: {};
+}, {
+    mfa: {};
+} & {
+    mfa: {
+        enroll: {
+            post: {
+                body: {
+                    issuer?: string | undefined;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        error: string;
+                        success?: undefined;
+                        secret?: undefined;
+                        uri?: undefined;
+                        qrDataUrl?: undefined;
+                    } | {
+                        success: boolean;
+                        secret: string;
+                        uri: string;
+                        qrDataUrl: string;
+                        error?: undefined;
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    mfa: {
+        "verify-enrollment": {
+            post: {
+                body: {
+                    code: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        error: string;
+                        valid?: undefined;
+                        backupCodes?: undefined;
+                    } | {
+                        valid: boolean;
+                        error: string;
+                        backupCodes?: undefined;
+                    } | {
+                        valid: boolean;
+                        backupCodes: string[];
+                        error?: undefined;
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    mfa: {
+        challenge: {
+            post: {
+                body: {
+                    userId: string;
+                    code: string;
+                };
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        valid: boolean;
+                    };
+                    422: {
+                        type: "validation";
+                        on: string;
+                        summary?: string;
+                        message?: string;
+                        found?: unknown;
+                        property?: string;
+                        expected?: string;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    mfa: {
+        status: {
+            get: {
+                body: unknown;
+                params: {};
+                query: unknown;
+                headers: unknown;
+                response: {
+                    200: {
+                        error: string;
+                        enabled?: undefined;
+                    } | {
+                        enabled: boolean;
+                        error?: undefined;
+                    };
+                };
+            };
+        };
+    };
+} & {
+    mfa: {
+        delete: {
+            body: unknown;
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: {
+                    error: string;
+                    success?: undefined;
+                } | {
+                    success: boolean;
+                    error?: undefined;
+                };
+            };
+        };
+    };
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+}, {
+    derive: {};
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: {};
+} & {
+    derive: {
+        readonly auth: null;
+        readonly user: null;
+    } | {
+        readonly auth: import("../auth/interfaces.js").AuthContext;
+        readonly user: {
+            id: string;
+            tenantId: string | null;
+            session: import("../auth/interfaces.js").AuthSession | null;
+        } | null;
+    };
+    resolve: {};
+    schema: {};
+    standaloneSchema: {};
+    response: import("elysia").ExtractErrorFromHandle<{
+        readonly auth: null;
+        readonly user: null;
+    } | {
+        readonly auth: import("../auth/interfaces.js").AuthContext;
+        readonly user: {
+            id: string;
+            tenantId: string | null;
+            session: import("../auth/interfaces.js").AuthSession | null;
+        } | null;
+    }>;
+}>;
+//# sourceMappingURL=mfa.controller.d.ts.map

package/dist/controllers/mfa.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mfa.controller.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAK,MAAM,QAAQ,CAAC;AAqBnC,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2KrB,CAAC"}

package/dist/controllers/mfa.controller.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * MFA Controller (Elysia Plugin)
+ * Handles /_auth/mfa/* endpoints for TOTP management
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mfaController = void 0;
+const elysia_1 = require("elysia");
+const index_js_1 = require("../auth/mfa/index.js");
+const auth_js_1 = require("../http/plugins/auth.js");
+const context_helper_js_1 = require("../http/context-helper.js");
+// Input schemas
+const EnrollSchema = elysia_1.t.Object({
+    issuer: elysia_1.t.Optional(elysia_1.t.String()),
+});
+const VerifyEnrollmentSchema = elysia_1.t.Object({
+    code: elysia_1.t.String({ minLength: 6, maxLength: 6 }),
+});
+const ChallengeSchema = elysia_1.t.Object({
+    userId: elysia_1.t.String(),
+    code: elysia_1.t.String({ minLength: 6 }),
+});
+exports.mfaController = new elysia_1.Elysia({ prefix: "/mfa", tags: ["MFA"] })
+    .use(auth_js_1.authPlugin)
+    /**
+     * POST /_auth/mfa/enroll
+     * Start TOTP enrollment
+     */
+    .post("/enroll", async (ctx) => {
+    const { rawDb, user } = (0, context_helper_js_1.getCtx)(ctx);
+    const { body, set } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    const mfaService = (0, index_js_1.createMfaService)(rawDb);
+    const result = await mfaService.enrollTotp({
+        userId: user.id,
+        issuer: body.issuer || "Archlast",
+        accountName: user.tenantId || user.id,
+    });
+    return {
+        success: true,
+        secret: result.secret,
+        uri: result.uri,
+        qrDataUrl: result.qrDataUrl,
+    };
+}, {
+    body: EnrollSchema,
+    detail: {
+        summary: "Enroll TOTP",
+        description: "Start TOTP enrollment and get QR code",
+    },
+})
+    /**
+     * POST /_auth/mfa/verify-enrollment
+     * Verify TOTP enrollment with code
+     */
+    .post("/verify-enrollment", async (ctx) => {
+    const { rawDb, user } = ctx;
+    const { body, set } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    const mfaService = (0, index_js_1.createMfaService)(rawDb);
+    const result = await mfaService.verifyTotpEnrollment({
+        userId: user.id,
+        code: body.code,
+    });
+    if (!result.valid) {
+        return { valid: false, error: "Invalid code" };
+    }
+    // Generate backup codes after successful enrollment
+    const backupCodes = await mfaService.generateBackupCodes(user.id);
+    return {
+        valid: true,
+        backupCodes: backupCodes.codes,
+    };
+}, {
+    body: VerifyEnrollmentSchema,
+    detail: {
+        summary: "Verify TOTP enrollment",
+        description: "Complete TOTP enrollment with verification code",
+    },
+})
+    /**
+     * POST /_auth/mfa/challenge
+     * Verify TOTP code during login
+     */
+    .post("/challenge", async (ctx) => {
+    const { rawDb } = ctx;
+    const { body, set } = (0, context_helper_js_1.getCtx)(ctx);
+    const mfaService = (0, index_js_1.createMfaService)(rawDb);
+    // Try TOTP first
+    let result = await mfaService.verifyTotp({
+        userId: body.userId,
+        code: body.code,
+    });
+    // If TOTP fails, try backup code
+    if (!result.valid) {
+        result = await mfaService.verifyBackupCode({
+            userId: body.userId,
+            code: body.code,
+        });
+    }
+    return { valid: result.valid };
+}, {
+    body: ChallengeSchema,
+    detail: {
+        summary: "MFA challenge",
+        description: "Verify TOTP or backup code during login",
+    },
+})
+    /**
+     * GET /_auth/mfa/status
+     * Check if MFA is enabled
+     */
+    .get("/status", async (ctx) => {
+    const { rawDb, user } = ctx;
+    const { set } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    const mfaService = (0, index_js_1.createMfaService)(rawDb);
+    const hasMfa = await mfaService.hasMfaEnabled(user.id);
+    return { enabled: hasMfa };
+}, {
+    detail: {
+        summary: "MFA status",
+        description: "Check if MFA is enabled for current user",
+    },
+})
+    /**
+     * DELETE /_auth/mfa
+     * Disable MFA for user
+     */
+    .delete("/", async (ctx) => {
+    const { rawDb, user } = ctx;
+    const { set } = (0, context_helper_js_1.getCtx)(ctx);
+    if (!user) {
+        set.status = 401;
+        return { error: "Unauthorized" };
+    }
+    const mfaService = (0, index_js_1.createMfaService)(rawDb);
+    await mfaService.removeMfa(user.id);
+    return { success: true };
+}, {
+    detail: {
+        summary: "Disable MFA",
+        description: "Remove MFA from current user account",
+    },
+});
+//# sourceMappingURL=mfa.controller.js.map

package/dist/controllers/mfa.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.controller.js","sourceRoot":"","sources":["../../src/controllers/mfa.controller.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,mCAAmC;AAGnC,mDAAwD;AACxD,qDAAqD;AACrD,iEAAmD;AAEnD,gBAAgB;AAChB,MAAM,YAAY,GAAG,UAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,UAAC,CAAC,QAAQ,CAAC,UAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,UAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACjD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,UAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,UAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,UAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACnC,CAAC,CAAC;AAEU,QAAA,aAAa,GAAG,IAAI,eAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KACrE,GAAG,CAAC,oBAAU,CAAC;IAChB;;;OAGG;KACF,IAAI,CACD,SAAS,EACT,KAAK,EAAE,GAAG,EAAE,EAAE;IACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU;QACjC,WAAW,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;KACxC,CAAC,CAAC;IAEH,OAAO;QACH,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,SAAS;KAC9B,CAAC;AACN,CAAC,EACD;IACI,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE;QACJ,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,uCAAuC;KACvD;CACJ,CACJ;IACD;;;OAGG;KACF,IAAI,CACD,oBAAoB,EACpB,KAAK,EAAE,GAAG,EAAE,EAAE;IACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAU,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC;QACjD,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACnD,CAAC;IAED,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAElE,OAAO;QACH,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,WAAW,CAAC,KAAK;KACjC,CAAC;AACN,CAAC,EACD;IACI,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE;QACJ,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,iDAAiD;KACjE;CACJ,CACJ;IACD;;;OAGG;KACF,IAAI,CACD,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,EAAE;IACV,MAAM,EAAE,KAAK,EAAE,GAAG,GAAU,CAAC;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAElC,MAAM,UAAU,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC;IAE3C,iBAAiB;IACjB,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;KAClB,CAAC,CAAC;IAEH,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC,CAAC;IACP,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACnC,CAAC,EACD;IACI,IAAI,EAAE,eAAe;IACrB,MAAM,EAAE;QACJ,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,yCAAyC;KACzD;CACJ,CACJ;IACD;;;OAGG;KACF,GAAG,CACA,SAAS,EACT,KAAK,EAAE,GAAG,EAAE,EAAE;IACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAU,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC,EACD;IACI,MAAM,EAAE;QACJ,OAAO,EAAE,YAAY;QACrB,WAAW,EAAE,0CAA0C;KAC1D;CACJ,CACJ;IACD;;;OAGG;KACF,MAAM,CACH,GAAG,EACH,KAAK,EAAE,GAAG,EAAE,EAAE;IACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAU,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,0BAAM,EAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,2BAAgB,EAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC,EACD;IACI,MAAM,EAAE;QACJ,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,sCAAsC;KACtD;CACJ,CACJ,CAAC"}